﻿
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<!-- saved from url=(0014)about:internet -->
<html xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:mssdk="winsdk" xmlns:script="urn:script" xmlns:build="urn:build" xmlns:MSHelp="http://msdn.microsoft.com/mshelp">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<meta name="Description" content="Forcing a System Crash from the Keyboard"/>
<meta name="MSHAttr" content="PreferredSiteName:MSDN"/>
<meta name="MSHAttr" content="PreferredLib:/library/windows/hardware"/>
<title>Forcing a System Crash from the Keyboard</title>

<meta name="MS-HAID" content="r10_dump_files_0f34a748-5ca4-487a-8101-7f320f16a023.xml"/>


<link rel="STYLESHEET" type="text/css" HREF="../common/backsdk4.css"/>





<style>
html,div { margin: 0; padding: 0;}

body {
	padding: 0px;
	margin: 0px;
	overflow: auto;
	height: 100%;
}

#winchm_template_button{
	float: right;
	width: 93px;
	top: 7px;
	position: relative;
	text-align: right;
	right: 5px;
	height: auto;
}

#winchm_template_top{
	padding: 0px;
	margin: 0px;
	border-bottom: 1px solid #9B9B9B;
	background-color: #B1CEFE;
}

#winchm_template_navigation{
	margin: 0px;
	padding-top: 7px;
	padding-left: 7px;
	padding-bottom: 3px;
	padding-right: 0px;
	font-size: 8.5pt;
	font-family: Arial, Helvetica, sans-serif;
	font-weight: normal;
	color: #585858;
}

#winchm_template_title{
	margin: 0px;
	padding-top: 4px;
	padding-left: 7px;
	padding-bottom: 7px;
	padding-right: 0px;
	font-size: 18px; 
	font-family: Verdana, Geneva, sans-serif;
	color: #363636;
}

#winchm_template_content{
	margin-top: 20px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	width: auto  !important;
	width: 100%;
}

#winchm_template_footer{
	border-width: 1px;
	border-color: #B1CEFE;
	border-top-style: solid;
	margin-top: 15px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	padding-top: 7px;
	padding-left: 0px;
	padding-bottom: 0px;
	padding-right: 0px;
	font-family: arial, helvetica, sans-serif;
	font-size: 8.5pt;
	color: #696969;
	width: auto;
	text-align: left;
}


#winchm_template_container{
	margin: 0px;
	padding: 0px;
	position: static;
	padding-bottom: 3px;
	overflow: auto;
	background-color: #FFFFFF;
}


@media print
{
#winchm_template_container{
	position: static;	
	margin: 0px;
	padding: 5px;
	
	width: auto;
	height: auto;
	overflow: auto;
}
#winchm_template_button{
visibility:hidden;
}
}

#winchm_template_navigation A:link	{text-decoration: none; color:#004080}
#winchm_template_navigation A:visited  {text-decoration: none; color: #004080}
#winchm_template_navigation A:active {text-decoration: none; color: #004080 }
#winchm_template_navigation A:hover {text-decoration: none;color: #0080FF}

A:link	{text-decoration: underline; color:#0033CC}
A:visited  {text-decoration: underline; color: #0033CC}
A:active {text-decoration: underline; color: #0033CC }
A:hover {text-decoration: underline;color: #FF0000;}
</style>
<script type="text/javascript">
function isMobile(){
Agent = window.navigator.userAgent;
if (Agent.indexOf("iPhone")>=1 || Agent.indexOf("iPad")>=1 || Agent.indexOf("iPod")>=1 || Agent.indexOf("Android")>=1){
return true;
}else{
return false;	
}

}
function d_onresize(){
if (window.navigator.userAgent.indexOf("MSIE")>=1){
document.getElementById('winchm_template_container').style.pixelWidth = document.body.offsetWidth - 3;
document.getElementById('winchm_template_container').style.pixelHeight = document.body.offsetHeight - document.getElementById('winchm_template_top').offsetHeight - 4;
}
document.getElementById('winchm_template_container').style.top = document.getElementById('winchm_template_top').offsetHeight + 'px';
}

function d_onbeforeprint(){
document.getElementById('winchm_template_container').style.width = 'auto';
document.getElementById('winchm_template_container').style.height = 'auto';
}

function d_onafterprint(){
d_onresize();
}

if(!isMobile()){

window.onload = d_onresize;
window.onresize = d_onresize;
window.onbeforeprint = d_onbeforeprint;
window.onafterprint = d_onafterprint;

document.write("<style>\n");
document.write("body {overflow: hidden;}\n");
document.write("#winchm_template_container {position: absolute;overflow: auto;top : 0px;right: 0px;bottom: 0px;left: 0px;}\n");
document.write("</style>\n");
}

</script>
</head>
<body><script language="JavaScript" type="text/JavaScript">
function syn(){
if(parent.nav.tree){
 if(parent.nav.tree.loaded){
  parent.nav.tree.selectNode(1568);
 }else{
  setTimeout("syn()",500);
}
  }else{
  setTimeout("syn()",500);
  }}
if(parent!=self){
  setTimeout("syn()",100);
}else{
  parent.location.href = "../../index.htm?page=debugger/forcing_a_system_crash_from_the_keyboard.htm";
}
originalOnload = window.onload;
if(originalOnload==null){
window.onload = function(){parent.contentLoaded = true;};
}else{
window.onload = function(){originalOnload();parent.contentLoaded = true;};
}
</script> 


<div id="winchm_template_top">
	<div id="winchm_template_button"><A href="forcing_a_system_crash_from_the_debugger.htm" title="Previous topic"><img id="winchm_template_prev" alt="Previous topic" src="../template2/btn_prev_n.gif" border="0"></a><A href="creating_a_dump_file_without_a_system_crash.htm" title="Next topic"><img id="winchm_template_next" alt="Next topic" src="../template2/btn_next_n.gif" border="0"></a></div>
	<div id="winchm_template_navigation">Help &gt; 
<A href="introduction6.htm">Debugging Tools for Windows (WinDbg, KD, CDB, NTSD)</A> &gt; <A href="crash_dump_files.htm">Crash dump analysis using the Windows debuggers (WinDbg)</A> &gt; <A href="kernel_mode_dump_files.htm">Kernel-Mode Dump Files</A> &gt; <A href="creating_a_kernel_mode_dump_file.htm">Creating a Kernel-Mode Dump File</A> &gt; <A href="forcing_a_system_crash.htm">Forcing a System Crash</A> &gt; </div>
	<div id="winchm_template_title">Forcing a System Crash from the Keyboard</div>
</div>
<div id="winchm_template_container">
	<div id="winchm_template_content"><div id="mainSection"><p>Most of the following keyboards can cause a system crash directly:</p>
<p></p>
<dl>
<dt><a id="________PS_2_keyboards_connected_on_i8042prt_ports_______"></a><a id="________ps_2_keyboards_connected_on_i8042prt_ports_______"></a><a id="________PS_2_KEYBOARDS_CONNECTED_ON_I8042PRT_PORTS_______"></a>
       PS/2 keyboards connected on i8042prt ports
      </dt>
<dd>
<p>This feature is available in Windows 2000 and later versions of Windows operating system.</p>
</dd>
<dt><a id="________USB_keyboards_______"></a><a id="________usb_keyboards_______"></a><a id="________USB_KEYBOARDS_______"></a>
       USB keyboards
      </dt>
<dd>
<p>This feature is available in:</p>
<ul>
<li>
<p>Windows Server 2003 Service Pack 1 if the hotfix available with <a href="http://go.microsoft.com/fwlink/p/?linkid=106065">KB 244139</a> is installed.</p>
</li>
<li>
<p>Windows Server 2003 (with Service Pack 2 or later).</p>
</li>
<li>
<p>Windows Vista Service Pack 1 if the hotfix available with <a href="http://go.microsoft.com/fwlink/p/?LinkId=241349">KB 971284</a> is installed.</p>
</li>
<li>
<p>Windows Vista Service Pack 2.</p>
</li>
<li>Windows Server 2008 Service Pack 1 if the hotfix available with <a href="http://go.microsoft.com/fwlink/p/?LinkId=241349">KB 971284</a> is installed.</li>
<li>Windows Server 2008 (with Service Pack 2 or later).</li>
<li>Windows 7 and later versions of Windows operating system.</li>
</ul>
<div class="alert"><b>Note</b>  This feature is not available in Windows XP.</div>
<div> </div>
</dd>
</dl>
<p>You must ensure the following three settings before the keyboard can cause a system crash:</p>
<ol>
<li>
<p>If you wish a crash dump file to be written, you must enable such dump files, choose the path and file name, and select the size of the dump file. For more information, see <a href="#Bookmark1565">Enabling a Kernel-Mode Dump File</a>.</p>
</li>
<li>
<p>With PS/2 keyboards, you must enable the keyboard-initiated crash in the registry. In the registry key <b>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters</b>, create a value named <b>CrashOnCtrlScroll</b>, and set it equal to a REG_DWORD value of 0x01.</p>
</li>
<li>
<p>With USB keyboards, you must enable the keyboard-initiated crash in the registry. In the registry key <b>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbdhid\Parameters,</b> create a value named <b>CrashOnCtrlScroll</b>, and set it equal to a REG_DWORD value of 0x01.</p>
</li>
</ol>
<p>You must restart the system for these settings to take effect.</p>
<p>After this is completed, the keyboard crash can be initiated by using the following hotkey sequence: Hold down the <u>rightmost</u> CTRL key, and press the SCROLL LOCK key twice.</p>
<p>The system then calls <b>KeBugCheck</b> and  issues <a href="#Bookmark1789"><b>bug check 0xE2</b></a> (MANUALLY_INITIATED_CRASH).   Unless crash dumps have been disabled, a crash dump file is written at this point.</p>
<p>If a kernel debugger is attached to the crashed machine, the machine will break into the kernel debugger after the crash dump file has been written.</p>
<p>For more information on using this feature, refer to the article <a href="http://go.microsoft.com/fwlink/p/?linkid=106065">Generate a memory dump file by using the keyboard (KB 244139)</a>.</p>
<h3><a id="defining_alternate_keyboard_shortcuts_to_force_a_system_crash_from_the"></a><a id="DEFINING_ALTERNATE_KEYBOARD_SHORTCUTS_TO_FORCE_A_SYSTEM_CRASH_FROM_THE"></a>Defining Alternate Keyboard Shortcuts to Force a System Crash from the Keyboard</h3>
<p>You can configure values under the following registry subkeys for different keyboard shortcut sequences to generate the memory dump file: </p>
<ul>
<li>
<p>For PS/2 keyboards:</p>
<p><b>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\crashdump</b></p>
</li>
<li>
<p>For USB keyboards:</p>
<p><b>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\crashdump</b></p>
</li>
</ul>
<p>You must create the following registry REG_DWORD values under these subkeys: </p>
<p></p>
<dl>
<dt><a id="Dump1Keys"></a><a id="dump1keys"></a><a id="DUMP1KEYS"></a><b>Dump1Keys</b></dt>
<dd>
<p>The <b>Dump1Keys</b> registry value is a bit map of the first hot key to use. For example, instead of using the <u>rightmost</u> CTRL key to initiate the hot key sequence, you can set the first hot key to be the <u>leftmost</u> SHIFT key. </p>
<p>The values for the first hot key are described in the following table. </p>
<table>
<tr>
<th>Value</th>
<th>First key used in the keyboard shortcut sequence</th>
</tr>
<tr>
<td>
<p>0x01</p>
</td>
<td>
<p>Rightmost SHIFT key</p>
</td>
</tr>
<tr>
<td>
<p>0x02</p>
</td>
<td>
<p>Rightmost CTRL key</p>
</td>
</tr>
<tr>
<td>
<p>0x04</p>
</td>
<td>
<p>Rightmost ALT key</p>
</td>
</tr>
<tr>
<td>
<p>0x10</p>
</td>
<td>
<p>Leftmost SHIFT key</p>
</td>
</tr>
<tr>
<td>
<p>0x20</p>
</td>
<td>
<p>Leftmost CTRL key</p>
</td>
</tr>
<tr>
<td>
<p>0x40</p>
</td>
<td>
<p>Leftmost ALT key</p>
</td>
</tr>
</table>
<p> </p>
<div class="alert"><b>Note</b>  You can assign <b>Dump1Keys</b> a value that enables one or more keys as the first key used in the keyboard shortcut sequence. For example, assign <b>Dump1Keys</b> a value of 0x11 to define both the <u>rightmost</u> and <u>leftmost</u> SHIFT keys as the first key in the keyboard shortcut sequence.</div>
<div> </div>
</dd>
<dt><a id="Dump2Key"></a><a id="dump2key"></a><a id="DUMP2KEY"></a><b>Dump2Key</b></dt>
<dd>
<p>The <b>Dump2Key</b> registry value is the index into the scancode table for the keyboard layout of the target computer. The following is the actual table in the driver. </p>
<div class="code"><span codelanguage=""><table>
<tr>
<th></th>
</tr>
<tr>
<td>
<pre>const UCHAR keyToScanTbl[134] = { 
        0x00,0x29,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,
        0x0A,0x0B,0x0C,0x0D,0x7D,0x0E,0x0F,0x10,0x11,0x12,
        0x13,0x14,0x15,0x16,0x17,0x18,0x19,0x1A,0x1B,0x00,
        0x3A,0x1E,0x1F,0x20,0x21,0x22,0x23,0x24,0x25,0x26,
        0x27,0x28,0x2B,0x1C,0x2A,0x00,0x2C,0x2D,0x2E,0x2F,
        0x30,0x31,0x32,0x33,0x34,0x35,0x73,0x36,0x1D,0x00,
        0x38,0x39,0xB8,0x00,0x9D,0x00,0x00,0x00,0x00,0x00,
        0x00,0x00,0x00,0x00,0x00,0xD2,0xD3,0x00,0x00,0xCB,
        0xC7,0xCF,0x00,0xC8,0xD0,0xC9,0xD1,0x00,0x00,0xCD,
        0x45,0x47,0x4B,0x4F,0x00,0xB5,0x48,0x4C,0x50,0x52,
        0x37,0x49,0x4D,0x51,0x53,0x4A,0x4E,0x00,0x9C,0x00,
        0x01,0x00,0x3B,0x3C,0x3D,0x3E,0x3F,0x40,0x41,0x42,
        0x43,0x44,0x57,0x58,0x00,0x46,0x00,0x00,0x00,0x00,
        0x00,0x7B,0x79,0x70 };</pre>
</td>
</tr>
</table></span></div>
<div class="alert"><b>Note</b>    Index 124 (sysreq) is a special case because an 84-key keyboard has a different scan code. </div>
<div> </div>
</dd>
</dl>
<p>If you define alternate keyboard shortcuts to force a system crash from a USB or PS/2 keyboard, you must either set the <b>CrashOnCtrlScroll</b> registry value to 0 or remove it from the registry.</p>
<h3><a id="limitations"></a><a id="LIMITATIONS"></a>Limitations</h3>
<p>It is possible for a system to freeze in such a way that the keyboard shortcut sequence will not work. However, this should be a very rare occurrence. Using the keyboard shortcut sequence to initiate a crash will work even in many instances where CTRL+ALT+DELETE does not work.</p>
<p>Forcing a system crash from the keyboard does not work if the computer stops responding at a high interrupt request level (IRQL). This limitation exists because the Kbdhid.sys driver, which allows the memory dump process to run, operates at a lower IRQL than the i8042prt.sys driver. </p></div></div>	
	<div id="winchm_template_footer">Copyright &copy; 2019. All rights 
reserved. (To change the copyright info, just edit it in template.)</div>
</div>

</body>
</html>
